Privacy Policy

January 2026

We are committed to safeguarding your personal information.

At Canvas Holdings, LLC (“Canvas”), we know that the protection of personal information is of great importance to our customers and visitors to our website at canvasconsumer.com (“Site”). This Privacy Policy describes how we collect, use, disclose, store, and otherwise process information through this Site in the United States. We urge you to read this Privacy Policy in order to understand our commitment to you and your privacy and how you can participate in that commitment.

Our Privacy Policy

This is the Privacy Policy of Canvas Holdings, LLC, and its affiliated companies and subsidiaries (collectively, “Canvas,” “we,” “our,” and “us”) regarding the use and interaction with Canvas and its website www.canvasconsumer.com and all associated software, applications, websites, portals and cloud servers (collectively, the “Site”). The use of the terms “user,” “you,” “your,” “customer,” or “consumer” refer to users of our Site, patrons of our services, and others who may interact with us. By using our Site, you consent to this Privacy Policy, as amended from time to time.

Canvas values your patronage and protecting your confidential information is our priority. Our policies and procedures reinforce our commitment to protecting the confidentiality and security of the information we collect about you as a customer, potential customer, or former customer. We have adopted the following policies and procedures to safeguard the personal information about you in our possession.

We have adopted the policies outlined in this Privacy Policy, which serve as the basis for our use of your personal information in our business and advertiser relationships. This Privacy Policy is intended to comply with privacy laws applicable to us and our companies, and the operation of the Site. This Privacy Policy, however, does not cover our or our affiliates’ offline privacy practices for personal information you may provide to us through means other than through our Site.

We will not sell, share, or rent this information to others in ways other than those outlined in this Privacy Policy. We collect information from our users at several different points on the Site. Personal Information (defined below) provided by users will be used by us to improve the Site and provide a more personalized experience for the user, but information which identifies a specific individual will not be disclosed to others without the user’s permission unless necessary to provide services which the user has requested.

Any capitalized terms not defined herein shall have the meaning ascribed to them in the Terms of Use which are incorporated herein by reference (the “Terms”). In the event of a conflict between this Privacy Policy and the Terms, the provisions of this Privacy Policy will prevail.

General.

We collect information about you to help us serve your financial needs, to provide you with quality products and services, and to fulfill legal and regulatory requirements. We consider non-public information about you in our possession to be personally identifiable information, even if you cease to be a customer. The personally identifiable information we collect about you may include among other things:

Identifying information, such as your name, age/date of birth, address, phone number, email address, driver’s license, citizenship information, and social security number
Financial information such as your income, assets and liabilities, as well as information about your savings, investments, insurance, business, and debt history
Banking information and documents, banks statements, tax information and returns, and corporate documents

Personal Information.

In certain situations, we use your Personal Information to pull a credit report from a credit bureau to determine your credit worthiness as well as to help our underwriters to assess your loan request in the context of your overall financial situation. We will also use your required and optional information to facilitate activities and transactions that need to occur during certain processes such as:

Enabling our financial services partners to implement automatic payments and funds transfer
Contact you if there is a problem completing a transaction you requested or to discuss a problem with your account
Implementing collection activities as needed
Maintaining regular communication with you as may be necessary to provide debt collection services, debt purchasing services, loan origination and loan services and/or to execute loan application, loan or other financial agreements and certain stipulations such as identity verification, income verification and employment verification
To market our products and/or services to you
To analyze usage on our Site and improve the services offered
For market research, project planning, and troubleshooting problems
For detecting and protecting against error, fraud, or other criminal activity
To enforce our terms, agreements, and policies
To comply with applicable laws

What kinds of information and data do we collect?

We may ask for certain Personal Information to make our services available to you. Generally, this data is collected through applications and other forms you complete, as well as in conversations you may have with our loan originators and processors or other representatives and, in some cases, through our Site. We may also collect information from publicly available data and a wide range of other sources in order to process and/or underwrite your loan. These sources may include, among others, banks, title insurers, insurance companies, and credit reporting agencies.

When requesting goods or services through our Site, you may be asked to enter your Personal Information as defined herein. We will retain your information for as long as your account is active or as needed to provide you services or in accordance with our data retention policy. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, which may be indefinitely.

In addition, we collect Personal Information through our Site by way of web form submissions, primarily for the purpose of engaging in support. We also collect anonymous information about how visitors use our Site; for example, we utilize web analytics software to track, in aggregate, the number of unique views received by the pages of the web site, and the domains from which users originate, along with many other analytical data points.

Beyond the Personal Information you voluntarily provide to us directly, we utilize third-party analytics tools including technologies such as Google Analytics, to collect information utilizing cookies. Certain types of information, including geolocation, device type, onsite website usage and behavior, demographic data, and purchase history, are collected and aggregated across the users of our Site for our analysis and advertising efforts. Please refer to Google’s Privacy Policy for more information.

Our Site also automatically collects information about visits to the Site including, but not limited to, interaction with the Site, the browser used, the URLs from where the user came, the computer’s operating system, the user’s IP address, and other usage and browsing information. Such information may be used to diagnose and resolve server problems, analyze trends, target offers and ads, and track user movement in the aggregate. Our Site supports mobile access. As such, it may gather location-based data from mobile devices. Our Site also uses cookies/web beacons to identify users when they surf onto the Site as well as to track relevant data about the user. The collected information is stored in electronic databases.

You understand that you shall be solely responsible for the accuracy and truthfulness of the Personal Information shared with us. In the event you share any Personal Information on behalf of a third person, you shall ensure that you have the necessary authority to share such Personal Information with us.

Who is collecting the data?

Canvas and collaborating third parties collect the data in order to communicate with and provide service to our Users.

Our Legal Basis for Collecting Data.

We will not process your Personal Information without a lawful basis to do so. We will process your Personal Information only on the legal bases of consent or on the basis of our legitimate interests, provided that such interests are not overridden by your privacy rights and interests.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information, including Transport Layer Security (TLS) encryption to minimize the chances that personal information will be read as it passes over the Internet. Additionally, our Site uses https on its web pages to prevent unauthorized interception of communications and to protect passwords from unauthorized access.

Your Rights Regarding the Data We Collect.

With respect to the data we collect from you, you have the following rights:

the right to be informed about the data we collect;
the right to access and review the data we have collected from you;
the right of rectification or correction of any data we have collected from you;
the right to have any/all data we collect removed;
the right to restrict how we process data we collect from you;
the right to data portability;
the right to object to our collection of data; and
the right to prevent direct marketing, automated decision-making, and profiling.

If you wish to take advantage of any of the above rights, please contact us and we will comply at no charge to you. To review, request a copy of, or delete your account information you may contact us via e-mail at: compliance@canvasholdings.com

Our Data Retention Period.

Our Site retains information collected in our server logs, databases, or any other records, for as long as necessary, in order to fulfill the purposes for which it was collected (contact with us, processing consumer requests, and the provision of our services to you), as well as for legal compliance, as set out above.

How do we use collected information?

We do not sell, trade, or otherwise transfer your Personal Information to outside parties. This does not include trusted third parties who assist us in operating our Site, conducting our business, or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our Site policies, or protect ours or others’ rights, property, or safety. However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

We collect Personal Information which we use to provide you with our services, as well as news, special offers, or general information, only if you have willingly Opted In to receive such information.

Additionally, we may collect and use your Personal Information for the following purposes:

Promoting safety and security. We use the information we have to help verify accounts and activity, and to promote safety and security on and off our Services, such as by investigating suspicious activity or violations of our terms or policies.
Communicating with you. We use your information to send you marketing communications, communicate with you about our business, and let you know about our policies and terms. We also use your information to respond to you when you contact us.
Sending emails or push notifications. We may also send SMS text messages or emails such as company news, updates, related product or service information, etc., and we will use your basic Personal Information to respond to inquiries, questions, and/or other requests. We may also use your Information for the purpose of sending you direct marketing (whether by messaging within our services, by email, SMS, or other means) that offer or advertise our services and/or the products and services of selected third parties. You may at any time change your preferences or turn off notifications, which will alter or cease the specific notifications you receive. You may also unsubscribe or opt out at any time, in which case we will cease sending you reminder emails, but you may continue getting shared content from others until you specifically turn off those notifications. We may use a third-party mailing list service for company announcements or occasional marketing emails, and you may need to unsubscribe from these emails separately than other types of emails.

Collected Information.

We may collect information from you in several different ways including the following:

Requests. When you request information from us, by phone or e-mail, through the Site, we may collect certain personally identifiable information from you. If you respond to a survey or sign up for a contest or drawing, we may request certain Personal Information. We use this information to provide you with information, customer service, or other services related to your request.
Log Files. As is true of most websites, we gather certain information automatically and store it in log files. This information includes Internet Protocol (IP) addresses, browser type, Internet Service Provider (ISP), referring/exit pages, operating system, date/time stamp, and movements around the site, and to gather demographic information about our user base as a whole. We do not link this automatically collected data to personally identifiable information.
Correspondence. If you send us personal correspondence, such as an email or letter, we may collect such information into a file specific to you.
Third Party Referral. We may collect certain personally identifiable information regarding you, when a third party may voluntarily provide such information.
Public/Sponsored Events. Canvas may participate in public events and events with multiple sponsors, such as community events or seminars. The events generally collect certain personally identifiable information from all attendees and distribute this data in whole or in part to all the event sponsors including the Community. While we cannot control and are not responsible for the practices of other sponsors for these events, we will maintain the privacy of our copy of your Personal Information received in this way.
Links. The Site may contain links to other sites. However, please be aware that we are not responsible for and cannot control the privacy policies of such other sites. We encourage you to be aware when you leave the Site, and to read the privacy policies of each and every website that collects personally identifiable information. This Privacy Policy applies solely to information collected by our Site.

Cookies

Cookies are data files that are written onto your computer by a website or software application (such as our Site) and stay there unless they expire or are removed by you. Cookies enable us to recognize your computer when you revisit the Site and recall your Site preferences to enhance your experience in using the Site. We use both session ID cookies and persistent cookies. A session ID cookie expires when you close your browser. A persistent cookie remains on your hard drive for an extended period of time. You can remove persistent cookies by following directions provided in your Internet browser’s “help” file. On our Site, we use session cookies to make it easier for you to navigate the website by remembering your locale preferences and to improve and track the overall experience on our Site. We also set a persistent cookie to authenticate your login and authorization to use the services. Persistent cookies enable us to track, store, and target the interests of our users to enhance the experience on the Site. If you reject cookies, you may still use the Site, but your ability to use some areas of the Site may be limited.

Consult your browser Help menu to learn more about how you can configure your browser software to notify you when your computer receives a new cookie. Note that you may also be able to configure your browser to disable the creation of cookies entirely (although your full interactive use of the Site may be adversely impacted if you do this.) This Privacy Policy covers the use of cookies by the Site only and does not cover the use of cookies by any advertisers or third parties.

Do Not Track and Opt Out

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. DNT is a way for users to inform websites and services that they do not want certain information about their webpage visits collected over time and across websites or online services. To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/orgs. For any SMS promotional campaigns users opt in to receiving, the users can easily respond with STOP to unsubscribe at any time.

Web Beacons

Web beacons are very small, invisible graphics present on web pages or emails that help us track when the page or email has been accessed. Some parts of the Site, emails, and other files may use web beacons, also known as clear gif technology or action tags. We do not use web beacons to collect, use, or store any Personal Information about you.

Customer Service

Based upon the personally identifiable information you provide us we may send you a confirmation e-mail to act as a receipt of your purchase. We will also communicate with you in response to your inquiries and to provide the services you request.

Business Services

Canvas will also communicate with you in connection with services you request from us.

California Online Privacy Protection Act Compliance

Because we value your privacy, we have taken the necessary precautions to comply with the California Consumer Privacy Act (“CCPA”) as set forth in the latest available regulations. The CCPA applies to California consumers and grants those consumers certain rights relating to the control of their personal information that has been collected or used by businesses. We therefore will not distribute your personal information to outside parties without your consent. As to the data of California consumers, in the event of a conflict between this Privacy Policy and the CCPA, the CCPA principles will govern.

Disclosure of Collected Information

Information from the Site. Canvas will never disclose your e-mail address, phone number, or other Personal Information that we collect via the Site to non-affiliated third parties without your prior approval. However, we reserve the right to outsource certain activities to certain third parties. In such cases, we strictly limit the information provided to these third parties to the minimum necessary for them to perform the functions for which we have retained them and prohibit them from using the information for any other purpose or retaining it after it is no longer needed.
Law Enforcement. We will, however, cooperate with official law enforcement inquiries, such as fraud investigations and subpoenas, and will disclose your information when necessary to comply with state and federal laws and regulations.
Disclaimer. We cannot ensure that all of your private communications and other Personal Information will never be disclosed in ways not otherwise described in this Privacy Policy. By way of example (without limiting the foregoing), we may be forced to disclose Personal Information to the government or third parties under certain circumstances, third parties may unlawfully intercept or access transmission or private communications, or users may abuse or misuse your Personal Information that they collect from the Site.
Children 18 Years of Age and Younger. You must be 18 or over to use the Site. Canvas is in compliance with the requirements of COPPA (Children’s Online Privacy Protection Act), we do not collect any information from anyone under 13 years of age. Our Site and services are all directed to people who are at least 13 years old or older.

Security

Canvas is committed to ensuring that your information is protected while you are on the Site. We use appropriate and reasonable measures to maintain the security of your Personal Information. This includes procedures followed by our personnel to prevent data loss or theft, physical security of our servers and information stores, and electronic security such as firewalls, password-protected databases, and secure connections. We may use certain third parties for services such as software platforms, advertising, or marketing. We only work with third parties whose privacy policies and security practices are equal to or more stringent than our own and who agree to strictly limit their use of the information we provide them to fulfill the functions for which they have been retained. You should be aware, however, that no data transmitted over the Internet, sent through the mail or stored on a computer is 100% secure and that we cannot guarantee the security of your personal data while in transmission to us. Public computers in particular should never be considered secure. You should never give out Personal Information on message boards, in chat rooms, or publicly viewable locations. In addition, there exist malicious programs, typically called computer viruses or trojan horses, which can be used to capture information off your computer’s hard drive or while you are entering it into a web form or sending it by email. You should always use the appropriate anti-virus and personal security technology to protect yourself. Lastly, if you have been assigned a login ID and/or password for use on our Site, you should never give out that information to others.

Enforcement

If for some reason you believe Canvas has not adhered to the principles of this Privacy Policy, please notify us, and we will do our best to determine and correct the problem promptly.

Disputes

This Privacy Policy shall be interpreted and governed by the laws of the United States and the State of Texas, without regard to conflicts of laws. Any dispute arising out of this Privacy Policy shall be settled by final and binding arbitration conducted in Dallas, Texas, by one neutral arbitrator knowledgeable in the subject matter covered by this Privacy Policy, in accordance with this Section and the then current Commercial Arbitration Rules of the American Arbitration Association (“AAA”). The successful party in the arbitration shall be awarded by the arbitrator that party’s costs and expenses, including attorneys’ fees and administrative fees of the AAA. An award may be confirmed and judgment entered in any court having competent jurisdiction. Except as otherwise provided for herein, any litigation initiated under such act or otherwise shall be conducted in a court of competent jurisdiction located in Dallas, Dallas County, Texas.

Additional Information

Notification of Privacy Policy Changes. Canvas reserves the right to change this Privacy Policy at any time, and you may visit this page to learn of our revised Privacy Policy. All such changes shall be binding on you 14 calendar days after they are initially posted on the Site unless you are a new user, in which case they are binding on you immediately.
Business Transition. In the event we go through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of our assets, your personally identifiable information will likely be among the assets transferred.
Notices. Any notices or other communication required or permitted to be made or given by either Party pursuant to this Privacy Policy will be in writing, in English, and will be deemed to have been duly given when delivered if delivered to the address specified herein or such other address as Canvas may specify in writing.
All notices must be sent to:

Canvas Holdings, LLC
P.O. Box 17368
Austin, TX 78760

or via email to: compliance@canvasholdings.com.
Contact Us. If you have any questions or suggestions regarding our privacy policy, please contact us via email at: compliance@canvasholdings.com.
Representations and Warranties. By using the Site, you represent that you are seeking the Site for personal reasons and that you are not an attorney or an agent of an attorney conducting an investigation to a potential claim related to the Site, any material available through the Site, or Canvas. You also represent that you are not engaging in activities in an attempt to reverse engineer the Site, portions of the Site, or any materials available through the Site. You also represent that any information you provide is true and accurate.
Customer Reference. You agree (i) that Canvas may identify you as a recipient of services and use your logo in client lists, sales presentations, marketing materials and press releases, and (ii) to develop a customer profile for use by the Community on Canvas websites for promotional purposes.